Implementation Practices of HTTP Security Headers on European News Portals

News portals are an important part of the digital public space because they have high traffic, public visibility, substantial advertising space, and they rely on the trust of their users. This is why implementing basic web security mechanisms on such portals is important. This paper presents a comparative analysis of the implementation of essential HTTP security headers on the most visited news portals across Europe. The analysis is based on a dataset of 225 news portals from 45 European countries, categorized into EU member states and non-EU countries. Data were collected in March 2025 using a custom Python script developed for automated analysis of HTTP response headers, focusing on HTTP Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), Referrer-Policy, and Permissions-Policy. The results show marked differences in the adoption of security headers between the two groups. Portals from EU member states more often apply basic HTTP security headers compared to portals outside the EU, where the difference is especially pronounced when HSTS headers are applied. The findings indicate gaps in the practical implementation of web security and suggest the need for improved baseline security configurations for news portals.